# Open-Source Supply Chain Poisoning Campaigns Drive CrowdStrike Endpoint-Based Package Interception

> DPRK-nexus STARDUST CHOLLIMA (aka Lazarus Group/Bluenoroff) poisoned 131+ Mastra AI framework npm packages via a typosquatted dependency, and eCrime actor ALTERED SPIDER (aka TeamPCP) ran a self-propagating npm/PyPI worm that compromised 300+ dependencies in a single day. CrowdStrike responded by embedding real-time supply chain attack interception directly in the Falcon endpoint sensor.

- **Published:** 2026-09-02T00:00:00Z
- **Last reviewed:** 2026-09-02T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-2294
- **ID:** TL-2026-2294
- **Severity:** HIGH
- **Category:** SUPPLY_CHAIN
- **Status:** ACTIVE
- **Actor:** APT38 (North Korea)
- **Detections:** 9 · **IOCs:** 18 (full data via the Threadlinqs MCP server — Purple tier)

## Description

CrowdStrike's 2026 Threat Hunting Report (published 2026-08-03) named two distinct, high-volume open-source supply chain campaigns as the trigger for a new Falcon sensor capability that intercepts and quarantines poisoned package downloads before execution. On 2026-09-02, CrowdStrike detailed this endpoint-embedded protection, framing the problem around agentic AI tools (Claude Code, ChatGPT Codex, and similar coding agents) that auto-download npm/PyPI dependencies on behalf of non-developer staff, expanding the population of endpoints exposed to a poisoned install beyond traditional developer workstations.

STARDUST CHOLLIMA, a DPRK-nexus (North Korea) financially-motivated intrusion set publicly overlapping with Lazarus Group and Bluenoroff, has run at least two documented 2026 campaigns against the npm ecosystem. On 2026-03-31, the group used stolen maintainer credentials to inject the cross-platform ZshBucket implant into the widely-used axios HTTP client package (CrowdStrike attributes this with moderate confidence, citing infrastructure overlap with prior STARDUST CHOLLIMA operations as well as shared hosting with FAMOUS CHOLLIMA's InvisibleFerret malware). On 2026-06-17, over an 88-minute automated window (01:12-02:39 UTC), the group hijacked a maintainer account and republished 131-142 packages across the @mastra npm scope (a popular AI-agent framework, combined weekly downloads over 1.1M) with a single injected dependency, easy-day-js — a typosquat of the dayjs date library carrying an obfuscated postinstall dropper that fetched a second-stage payload and then deleted itself.

ALTERED SPIDER (publicly tracked as TeamPCP), an eCrime actor active since at least November 2025, escalated in 2026 to a self-propagating, credential-stealing npm/PyPI worm lineage related to the 'Shai-Hulud' family. On 2026-05-19, a wave dubbed 'Mini Shai-Hulud' compromised the @antv namespace and 300+ npm packages (128K+ weekly downloads) in a 22-minute automated burst (01:39-02:06 UTC), using a bun-executed obfuscated payload (CanisterWorm) that harvested npm tokens, GitHub PATs, SSH keys, and cloud/CI-CD credentials, then re-published itself to every package reachable with the stolen tokens and exfiltrated secrets to newly-created public GitHub repositories. A later wave (publicly reported as CHAINDROP, disclosed around 2026-08-06 and reflected in a Singapore CSA advisory) hit the keyv cache-utility monorepo and 400+ related packages (1,300+ versions, ~2B monthly downloads), adding persistence via VS Code tasks.json and Claude Code's .claude/settings.json SessionStart hook, plus C2 address resolution through an Ethereum smart-contract resolver as a takedown-resistant fallback.

A thematically related but organizationally distinct campaign, PromptMink (disclosed by ReversingLabs on 2026-04-29 and attributed to Famous Chollima, a sibling DPRK cluster also tracked as Void Dokkaebi/PurpleBravo/UNC5342), demonstrates the specific AI-agent-targeting mechanism CrowdStrike's announcement warns about: packages engineered (polished READMEs, complete TypeScript typings, binary-obfuscated payloads) to be autonomously selected and installed by LLM coding agents rather than human developers, with at least one confirmed case of an agent installing the credential-stealing dependency with no human review, prompt injection, or jailbreak involved.

## MITRE ATT&CK

- T1588.002 Obtain Capabilities: Tool
- T1195.001 Supply Chain Compromise: Compromise Software Dependencies and Development Tools
- T1195.002 Supply Chain Compromise: Compromise Software Supply Chain
- T1059.007 Command and Scripting Interpreter: JavaScript
- T1059.006 Command and Scripting Interpreter: Python
- T1546 Event Triggered Execution
- T1027 Obfuscated Files or Information
- T1070.004 Indicator Removal: File Deletion
- T1552.001 Unsecured Credentials: Credentials In Files
- T1552.004 Unsecured Credentials: Private Keys
- T1528 Steal Application Access Token
- T1555 Credentials from Password Stores
- T1570 Lateral Tool Transfer
- T1005 Data from Local System
- T1567.001 Exfiltration Over Web Service: Exfiltration to Code Repository
- T1071.001 Application Layer Protocol: Web Protocols

## Sources

- [CrowdStrike Extends Endpoint Security to Stop Supply Chain Attacks](https://www.crowdstrike.com/en-us/blog/crowdstrike-extends-endpoint-security-to-stop-supply-chain-attacks/)
- [STARDUST CHOLLIMA Likely Compromises Axios npm Package](https://www.crowdstrike.com/en-us/blog/stardust-chollima-likely-compromises-axios-npm-package/)
- [Meet CrowdStrike's Adversary of the Month for April: STARDUST CHOLLIMA](https://www.crowdstrike.com/en-us/blog/meet-crowdstrikes-adversary-of-the-month-for-april-stardust-chollima/)
- [Altered Spider Adversary Profile](https://www.crowdstrike.com/en-us/adversaries/altered-spider/)
- [CrowdStrike 2026 Threat Hunting Report](https://www.crowdstrike.com/en-us/resources/reports/threat-hunting-report/)
- [DPRK STARDUST CHOLLIMA poisons Mastra AI npm packages: supply chain analysis](https://infosec.ge/blog/dprk-stardust-chollima-mastra-ai-npm-supply-chain/)
- [easy-day-js Supply Chain Attack Hits Mastra AI in npm](https://www.ox.security/blog/easy-day-js-supply-chain-attack-hits-mastra-ai-in-npm/)
- [Mastra npm Scope Takeover: 140+ Packages Compromised via easy-day-js](https://www.stepsecurity.io/blog/mastra-npm-packages-compromised-using-easy-day-js)
- [The @antv Ecosystem Was Compromised with Shai-Hulud Malware, 300+ Packages Affected](https://www.ox.security/blog/the-antv-ecosystem-was-compromised-with-shai-hulud-malware-300-packages-affected/)
- [Shai-Hulud strikes again: CHAINDROP worm hits 400+ npm packages](https://www.elastic.co/security-labs/shai-hulud-chaindrop-npm-supply-chain)
- [Ongoing npm Supply Chain Attack Affecting Keyv and Related Packages](https://www.csa.gov.sg/alerts-and-advisories/advisories/ad-2026-009/)
- [PromptMink: How North Korea Tricked Claude Into Installing npm Malware](https://blog.barrack.ai/promptmink-north-korea-claude-npm-malware/)
- [Self-Propagating Supply Chain Worm Hijacks npm Packages to Steal Developer Tokens](https://thehackernews.com/2026/04/self-propagating-supply-chain-worm.html)
- [Self-Replicating Worm Hits 180+ Software Packages](https://krebsonsecurity.com/2025/09/self-replicating-worm-hits-180-software-packages/)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-2294